1/*
2 * Copyright (C) 2008 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *  * Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 *  * Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in
12 *    the documentation and/or other materials provided with the
13 *    distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include "libc_init_common.h"
30
31#include <elf.h>
32#include <errno.h>
33#include <fcntl.h>
34#include <stddef.h>
35#include <stdint.h>
36#include <stdio.h>
37#include <stdlib.h>
38#include <string.h>
39#include <sys/auxv.h>
40#include <sys/personality.h>
41#include <sys/time.h>
42#include <unistd.h>
43
44#include "private/bionic_auxv.h"
45#include "private/bionic_ssp.h"
46#include "private/bionic_tls.h"
47#include "private/KernelArgumentBlock.h"
48#include "private/libc_logging.h"
49#include "pthread_internal.h"
50
51extern "C" abort_msg_t** __abort_message_ptr;
52extern "C" int __system_properties_init(void);
53extern "C" int __set_tls(void* ptr);
54extern "C" int __set_tid_address(int* tid_address);
55
56__LIBC_HIDDEN__ void __libc_init_vdso();
57
58// Not public, but well-known in the BSDs.
59const char* __progname;
60
61// Declared in <unistd.h>.
62char** environ;
63
64// Declared in "private/bionic_ssp.h".
65uintptr_t __stack_chk_guard = 0;
66
67/* Init TLS for the initial thread. Called by the linker _before_ libc is mapped
68 * in memory. Beware: all writes to libc globals from this function will
69 * apply to linker-private copies and will not be visible from libc later on.
70 *
71 * Note: this function creates a pthread_internal_t for the initial thread and
72 * stores the pointer in TLS, but does not add it to pthread's thread list. This
73 * has to be done later from libc itself (see __libc_init_common).
74 *
75 * This function also stores a pointer to the kernel argument block in a TLS slot to be
76 * picked up by the libc constructor.
77 */
78void __libc_init_tls(KernelArgumentBlock& args) {
79  __libc_auxv = args.auxv;
80
81  static pthread_internal_t main_thread;
82
83  // Tell the kernel to clear our tid field when we exit, so we're like any other pthread.
84  // As a side-effect, this tells us our pid (which is the same as the main thread's tid).
85  main_thread.tid = __set_tid_address(&main_thread.tid);
86  main_thread.set_cached_pid(main_thread.tid);
87
88  // We don't want to free the main thread's stack even when the main thread exits
89  // because things like environment variables with global scope live on it.
90  // We also can't free the pthread_internal_t itself, since that lives on the main
91  // thread's stack rather than on the heap.
92  // The main thread has no mmap allocated space for stack or pthread_internal_t.
93  main_thread.mmap_size = 0;
94  pthread_attr_init(&main_thread.attr);
95  main_thread.attr.guard_size = 0; // The main thread has no guard page.
96  main_thread.attr.stack_size = 0; // User code should never see this; we'll compute it when asked.
97  // TODO: the main thread's sched_policy and sched_priority need to be queried.
98
99  __init_thread(&main_thread);
100  __init_tls(&main_thread);
101  __set_tls(main_thread.tls);
102  main_thread.tls[TLS_SLOT_BIONIC_PREINIT] = &args;
103
104  __init_alternate_signal_stack(&main_thread);
105}
106
107void __libc_init_common(KernelArgumentBlock& args) {
108  // Initialize various globals.
109  environ = args.envp;
110  errno = 0;
111  __libc_auxv = args.auxv;
112  __progname = args.argv[0] ? args.argv[0] : "<unknown>";
113  __abort_message_ptr = args.abort_message_ptr;
114
115  // AT_RANDOM is a pointer to 16 bytes of randomness on the stack.
116  __stack_chk_guard = *reinterpret_cast<uintptr_t*>(getauxval(AT_RANDOM));
117
118  // Get the main thread from TLS and add it to the thread list.
119  pthread_internal_t* main_thread = __get_thread();
120  __pthread_internal_add(main_thread);
121
122  __system_properties_init(); // Requires 'environ'.
123
124  __libc_init_vdso();
125}
126
127__noreturn static void __early_abort(int line) {
128  // We can't write to stdout or stderr because we're aborting before we've checked that
129  // it's safe for us to use those file descriptors. We probably can't strace either, so
130  // we rely on the fact that if we dereference a low address, either debuggerd or the
131  // kernel's crash dump will show the fault address.
132  *reinterpret_cast<int*>(line) = 0;
133  _exit(EXIT_FAILURE);
134}
135
136// Force any of the closed stdin, stdout and stderr to be associated with /dev/null.
137static void __nullify_closed_stdio() {
138  int dev_null = TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR));
139  if (dev_null == -1) {
140    // init won't have /dev/null available, but SELinux provides an equivalent.
141    dev_null = TEMP_FAILURE_RETRY(open("/sys/fs/selinux/null", O_RDWR));
142  }
143  if (dev_null == -1) {
144    __early_abort(__LINE__);
145  }
146
147  // If any of the stdio file descriptors is valid and not associated
148  // with /dev/null, dup /dev/null to it.
149  for (int i = 0; i < 3; i++) {
150    // If it is /dev/null already, we are done.
151    if (i == dev_null) {
152      continue;
153    }
154
155    // Is this fd already open?
156    int status = TEMP_FAILURE_RETRY(fcntl(i, F_GETFL));
157    if (status != -1) {
158      continue;
159    }
160
161    // The only error we allow is that the file descriptor does not
162    // exist, in which case we dup /dev/null to it.
163    if (errno == EBADF) {
164      // Try dupping /dev/null to this stdio file descriptor and
165      // repeat if there is a signal. Note that any errors in closing
166      // the stdio descriptor are lost.
167      status = TEMP_FAILURE_RETRY(dup2(dev_null, i));
168      if (status == -1) {
169        __early_abort(__LINE__);
170      }
171    } else {
172      __early_abort(__LINE__);
173    }
174  }
175
176  // If /dev/null is not one of the stdio file descriptors, close it.
177  if (dev_null > 2) {
178    if (close(dev_null) == -1) {
179      __early_abort(__LINE__);
180    }
181  }
182}
183
184// Check if the environment variable definition at 'envstr'
185// starts with '<name>=', and if so return the address of the
186// first character after the equal sign. Otherwise return null.
187static const char* env_match(const char* envstr, const char* name) {
188  size_t i = 0;
189
190  while (envstr[i] == name[i] && name[i] != '\0') {
191    ++i;
192  }
193
194  if (name[i] == '\0' && envstr[i] == '=') {
195    return envstr + i + 1;
196  }
197
198  return nullptr;
199}
200
201static bool __is_valid_environment_variable(const char* name) {
202  // According to the kernel source, by default the kernel uses 32*PAGE_SIZE
203  // as the maximum size for an environment variable definition.
204  const int MAX_ENV_LEN = 32*4096;
205
206  if (name == nullptr) {
207    return false;
208  }
209
210  // Parse the string, looking for the first '=' there, and its size.
211  int pos = 0;
212  int first_equal_pos = -1;
213  while (pos < MAX_ENV_LEN) {
214    if (name[pos] == '\0') {
215      break;
216    }
217    if (name[pos] == '=' && first_equal_pos < 0) {
218      first_equal_pos = pos;
219    }
220    pos++;
221  }
222
223  // Check that it's smaller than MAX_ENV_LEN (to detect non-zero terminated strings).
224  if (pos >= MAX_ENV_LEN) {
225    return false;
226  }
227
228  // Check that it contains at least one equal sign that is not the first character
229  if (first_equal_pos < 1) {
230    return false;
231  }
232
233  return true;
234}
235
236static bool __is_unsafe_environment_variable(const char* name) {
237  // None of these should be allowed in setuid programs.
238  static const char* const UNSAFE_VARIABLE_NAMES[] = {
239      "GCONV_PATH",
240      "GETCONF_DIR",
241      "HOSTALIASES",
242      "JE_MALLOC_CONF",
243      "LD_AOUT_LIBRARY_PATH",
244      "LD_AOUT_PRELOAD",
245      "LD_AUDIT",
246      "LD_DEBUG",
247      "LD_DEBUG_OUTPUT",
248      "LD_DYNAMIC_WEAK",
249      "LD_LIBRARY_PATH",
250      "LD_ORIGIN_PATH",
251      "LD_PRELOAD",
252      "LD_PROFILE",
253      "LD_SHOW_AUXV",
254      "LD_USE_LOAD_BIAS",
255      "LOCALDOMAIN",
256      "LOCPATH",
257      "MALLOC_CHECK_",
258      "MALLOC_CONF",
259      "MALLOC_TRACE",
260      "NIS_PATH",
261      "NLSPATH",
262      "RESOLV_HOST_CONF",
263      "RES_OPTIONS",
264      "TMPDIR",
265      "TZDIR",
266      nullptr
267  };
268  for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != nullptr; ++i) {
269    if (env_match(name, UNSAFE_VARIABLE_NAMES[i]) != nullptr) {
270      return true;
271    }
272  }
273  return false;
274}
275
276static void __sanitize_environment_variables(char** env) {
277  bool is_AT_SECURE = getauxval(AT_SECURE);
278  char** src = env;
279  char** dst = env;
280  for (; src[0] != nullptr; ++src) {
281    if (!__is_valid_environment_variable(src[0])) {
282      continue;
283    }
284    // Remove various unsafe environment variables if we're loading a setuid program.
285    if (is_AT_SECURE && __is_unsafe_environment_variable(src[0])) {
286      continue;
287    }
288    dst[0] = src[0];
289    ++dst;
290  }
291  dst[0] = nullptr;
292}
293
294static void __initialize_personality() {
295#if !defined(__LP64__)
296  int old_value = personality(0xffffffff);
297  if (old_value == -1) {
298    __libc_fatal("error getting old personality value: %s", strerror(errno));
299  }
300
301  if (personality((static_cast<unsigned int>(old_value) & ~PER_MASK) | PER_LINUX32) == -1) {
302    __libc_fatal("error setting PER_LINUX32 personality: %s", strerror(errno));
303  }
304#endif
305}
306
307void __libc_init_AT_SECURE(KernelArgumentBlock& args) {
308  __libc_auxv = args.auxv;
309
310  // Check that the kernel provided a value for AT_SECURE.
311  bool found_AT_SECURE = false;
312  for (ElfW(auxv_t)* v = __libc_auxv; v->a_type != AT_NULL; ++v) {
313    if (v->a_type == AT_SECURE) {
314      found_AT_SECURE = true;
315      break;
316    }
317  }
318  if (!found_AT_SECURE) __early_abort(__LINE__);
319
320  if (getauxval(AT_SECURE)) {
321    // If this is a setuid/setgid program, close the security hole described in
322    // ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc
323    __nullify_closed_stdio();
324
325    __sanitize_environment_variables(args.envp);
326  }
327
328  // Now the environment has been sanitized, make it available.
329  environ = args.envp;
330
331  __initialize_personality();
332}
333
334/* This function will be called during normal program termination
335 * to run the destructors that are listed in the .fini_array section
336 * of the executable, if any.
337 *
338 * 'fini_array' points to a list of function addresses. The first
339 * entry in the list has value -1, the last one has value 0.
340 */
341void __libc_fini(void* array) {
342  typedef void (*Dtor)();
343  Dtor* fini_array = reinterpret_cast<Dtor*>(array);
344  const Dtor minus1 = reinterpret_cast<Dtor>(static_cast<uintptr_t>(-1));
345
346  // Sanity check - first entry must be -1.
347  if (array == NULL || fini_array[0] != minus1) {
348    return;
349  }
350
351  // Skip over it.
352  fini_array += 1;
353
354  // Count the number of destructors.
355  int count = 0;
356  while (fini_array[count] != NULL) {
357    ++count;
358  }
359
360  // Now call each destructor in reverse order.
361  while (count > 0) {
362    Dtor dtor = fini_array[--count];
363
364    // Sanity check, any -1 in the list is ignored.
365    if (dtor == minus1) {
366      continue;
367    }
368
369    dtor();
370  }
371
372#ifndef LIBC_STATIC
373  {
374    extern void __libc_postfini(void) __attribute__((weak));
375    if (__libc_postfini) {
376      __libc_postfini();
377    }
378  }
379#endif
380}
381